ice: Protect the PF mailbox from flooding VFs

[kbowling]

Summary

Wire the shared code mailbox-overflow detector into the VF lifecycle
and virtchnl dispatcher.  E830 controllers use their per-VF hardware
in-flight-message watermark.  On older controllers, attribute a
congested mailbox snapshot to its sender and isolate the offending VF so
that it cannot continue to fill the shared queue.  A physical VFLR, PF
reset, or IOV recreation releases it.

Process at most one initially full mailbox immediately.  If producers
keep it nonempty, leave its interrupt masked and let the periodic admin
timer schedule bounded drain work.  This prevents sustained mailbox
traffic from monopolizing the iflib admin task.

Report software isolation and cumulative overflow events in the
driver.ice VF status extension, document both protection models, and add
failure-injection points for the isolation and scheduling paths.

On an E810-XXV with two host-attached iavf VFs, injected overflow on
VF 0 disabled only that VF while VF 1 completed 60 of 60 pings.  A
physical VFLR and a PF reset each released VF 0; IOV recreation also
reset its cumulative count.  Forced persistent mailbox-pending state
produced 20 admin and control-queue passes in five seconds, remained
timer-paced, and did not interrupt sibling traffic.

MFC after:      2 weeks
Sponsored by:   BBOX.io

Test Plan

Needs E830 testing